Skip to content

Commit b603dce

Browse files
shihai1991shihai s00424258
and
shihai s00424258
authored
[B605] Add functions that are vulnerable to shell injection. (#1116)
* extend injection shell * updated example of subprocess_shell --------- Co-authored-by: shihai s00424258 <[email protected]>
1 parent a682a18 commit b603dce

File tree

3 files changed

+9
-2
lines changed

3 files changed

+9
-2
lines changed

bandit/plugins/injection_shell.py

+4
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ def gen_config(name):
4949
"popen2.Popen4",
5050
"commands.getoutput",
5151
"commands.getstatusoutput",
52+
"subprocess.getoutput",
53+
"subprocess.getstatusoutput",
5254
],
5355
# Start a process with a function that is not vulnerable to shell
5456
# injection.
@@ -447,6 +449,8 @@ def start_process_with_a_shell(context, config):
447449
- popen2.Popen4
448450
- commands.getoutput
449451
- commands.getstatusoutput
452+
- subprocess.getoutput
453+
- subprocess.getstatusoutput
450454
451455
:Example:
452456

examples/subprocess_shell.py

+3
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@ def __len__(self):
2626
subprocess.check_output(['/bin/ls', '-l'])
2727
subprocess.check_output('/bin/ls -l', shell=True)
2828

29+
subprocess.getoutput('/bin/ls -l')
30+
subprocess.getstatusoutput('/bin/ls -l')
31+
2932
subprocess.run(['/bin/ls', '-l'])
3033
subprocess.run('/bin/ls -l', shell=True)
3134

tests/functional/test_functional.py

+2-2
Original file line numberDiff line numberDiff line change
@@ -493,8 +493,8 @@ def test_ssl_insecure_version(self):
493493
def test_subprocess_shell(self):
494494
"""Test for `subprocess.Popen` with `shell=True`."""
495495
expect = {
496-
"SEVERITY": {"UNDEFINED": 0, "LOW": 21, "MEDIUM": 1, "HIGH": 11},
497-
"CONFIDENCE": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 0, "HIGH": 32},
496+
"SEVERITY": {"UNDEFINED": 0, "LOW": 23, "MEDIUM": 1, "HIGH": 11},
497+
"CONFIDENCE": {"UNDEFINED": 0, "LOW": 1, "MEDIUM": 0, "HIGH": 34},
498498
}
499499
self.check_example("subprocess_shell.py", expect)
500500

0 commit comments

Comments
 (0)